cw2_8.py

@app.route('/product_reviews/<product_id>')
def product_reviews(product_id):
    from markupsafe import escape
    def get_reviews_from_database(product_id):
  
        reviews = Review.query.filter_by(product_id=product_id).all()
        reviews_list = [{'user_id': review.user_id, 'stars': review.stars, 'review': review.review} for review in reviews]
        return reviews_list

    def escape_html(input_text):
        return escape(input_text)
        
    reviews = get_reviews_from_database(product_id)
    log_analytics_event('Product View', product_id, request.remote_addr)
    # use escape_html to prevent XSS attacks
    for review in reviews:
        review['review'] = escape_html(review['review'])
response.headers['Content-Security-Policy'] = '; '.join([f"{key} {value}" for key, value in csp_policy.items()])
    return render_template('product_reviews.html', reviews=reviews)